Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx agentmods add skills/lantisprime/claude-sdlc/deploynpx skills add lantisprime/claude-sdlc --skill deploygit clone --depth 1 https://github.com/lantisprime/claude-sdlcWhat it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5 | $0.00091 | $0.00773 |
| Opus 5 | $0.00046 | $0.00387 |
| Sonnet 5 | $0.00018 | $0.00155 |
| Haiku 4.5 | $0.00009 | $0.00077 |
Grade A, and why
deploy scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 2d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 87 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Deploy (Phase 6)
Release code that has passed Test — under explicit human approval.
Prerequisite
.claude/sdlc/gates/test-<task-slug>.md must exist and be signed. Without it, this skill refuses to run.
Step 1 — Propose the deployment
Produce a deployment proposal, not a deployment. Include:
- Target environment (dev / staging / production)
- Commit SHA / tag / image reference
- Changed files and services
- DB migrations? (yes/no, reversible?)
- Feature flags? (default state)
- Rollback plan
- Blast radius (users/services affected)
- Deployment window / maintenance window if applicable
Step 2 — Human approval gate
This is non-negotiable. Deployments never auto-execute. Ask the human to confirm the proposal. Record the approval at .claude/sdlc/gates/deploy-<task-slug>.md with timestamp and approver.
Step 3 — Execute (under human supervision)
Execute the deployment via the configured pipeline/runbook. Stream output. Halt on the first error and ask for direction — do not retry automatically.
Step 4 — Record
Update the ticket(s) with:
- Commit SHA, environment, timestamp, approver
- Link to pipeline run / deployment log
- Post-deploy verification results (smoke tests)
Detection:
- GitHub/GitLab Issues via
.claude/sdlc/env.json→ comment on the issue - Jira/Linear via MCP → transition to "Deployed" (or equivalent) with a comment
- None configured → write
.claude/sdlc/deployments/<YYYY-MM-DD>-<task-slug>.md(or.jsonif configured)
Step 5 — Post-deploy verification
Run the smoke-test subset of the test suite against the deployed environment. If any fail:
- Execute the rollback from Step 1
- Log a defect (see
testskill) - Do not mark the deployment complete
What this skill must NEVER do
- Auto-execute a deployment.
- Skip the rollback plan.
- Close a ticket before post-deploy verification passes.
- Deploy code that does not have a signed test gate.
References
templates/deployment.mdtemplates/gate.mddocs/SDLC.mdDeploy
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 2d ago First seen · 87 lines · 91 tokens per session scan A db7a89ff63cc
deploy is a skill published in the GitHub repository lantisprime/claude-sdlc (3 stars, last pushed 4mo ago), licensed MIT. It adds 91 tokens to every session and 773 once invoked, about $0.0005 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.
Other skills, from other repositories
release-check
Pre-release checklist for Forge — verify, version bump, changelog, docs, docker build, smoke test. Run before tagging v.
landing
End-of-session ritual. Close finished beads, file new ones for remaining work, run verify, commit in logical groupings, push. Work is not complete until git push succeeds.
live-bugbash
Safe-by-default Symphony for Trello bug bash. Uses fake Trello, fake Codex, and fake/local GitHub unless explicitly asked for a real live bug bash; the phrase "hardened host" enables run-scoped danger-full-access and Codex dangerous-bypass coverage. Covers SPEC.md conformance, installers, CLI options, workflow…
ship-it
Get the work done in this conversation all the way out — merged, and deployed to every environment the repo has, production included. Grounds itself first in the branches written during this session, the open and closed PRs behind them, and the environments and CI/CD workflows the repo actually defines, then lands and…
ship-it-now
Same skill as /ship-it, with the ride-along confirmation gate turned off.
tendril-release
Updates the used Ivy NuGet packages to the latest stable versions in a branch from development, builds/verifies, merges into development, creates a PR into main, merges it, merges main back to development, and triggers the GitHub Actions release workflow.